Every CVE Search/ Get API key

CVE-2023-32697

Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled

8.8 HighPublic exploitFix available

SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.60%Up 1.6 points since May 24, 2023
90%50%10%1%

What each source reports

CVE List Score used 8.8

Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled

SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.

Record
CVE-2023-32697
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2023-1486 8.8

SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.

Record
EUVD-2023-1486
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-6phf-6h5g-97j2 8.8

Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled

Summary

Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL.

Impacted versions :

3.6.14.1-3.41.2.1

References

https://github.com/xerial/sqlite-jdbc/releases/tag/3.41.2.2

Record
GHSA-6phf-6h5g-97j2
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
NVD 8.8

SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.

Record
CVE-2023-32697
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSV 8.8

Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled

SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.

Record
CVE-2023-32697
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVDEBIAN-CVE-2023-32697 9.8

SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.

Record
DEBIAN-CVE-2023-32697
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-6phf-6h5g-97j2 8.8

Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled

Summary

Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL.

Impacted versions :

3.6.14.1-3.41.2.1

References

https://github.com/xerial/sqlite-jdbc/releases/tag/3.41.2.2

Record
GHSA-6phf-6h5g-97j2
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVOESA-2023-1792 9.8

sqlite-jdbc security update

SQLite JDBC, is a library for accessing and creating SQLite database files in Java.

Security Fix(es):

SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2. (CVE-2023-32697)

Record
OESA-2023-1792
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-32697 8.8

SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.

Record
UBUNTU-CVE-2023-32697
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.xerial:sqlite-jdbc
Maven
 3.6.14.1 up to 3.41.2.2
3.41.2.2
xerial-sqlite-jdbc
Debian:12
 before 3.40.1.0+dfsg-1+deb12u1, plus listed versions
3.40.1.0+dfsg-1
3.40.1.0+dfsg-1+deb12u1
xerial-sqlite-jdbc
Debian:13
 before 3.42.0.0+dfsg-1
3.42.0.0+dfsg-1
xerial-sqlite-jdbc
Debian:14
 before 3.42.0.0+dfsg-1
3.42.0.0+dfsg-1
org.xerial:sqlite-jdbc
Maven
 3.6.14.1 up to 3.41.2.2, plus listed versions
3.14.23.14.2.13.15.03.15.13.16.1
Show 45 moreShow less
3.18.03.19.33.20.03.20.13.21.03.21.0.13.23.13.25.23.27.23.27.2.13.28.03.30.13.31.13.32.33.32.3.13.32.3.23.32.3.33.34.03.35.03.35.0.13.36.03.36.0.13.36.0.23.36.0.33.39.2.03.39.2.13.39.3.03.39.4.03.39.4.13.40.0.03.40.1.03.41.0.03.41.0.13.41.2.03.41.2.13.6.14.23.6.153.6.163.6.173.6.17.13.6.203.7.15-M13.7.23.8.10.13.8.10.2
3.41.2.2
sqlite-jdbc
openEuler:20.03-LTS-SP1
 before 3.15.1-2.oe1
3.15.1-2.oe1
sqlite-jdbc
openEuler:20.03-LTS-SP3
 before 3.15.1-2.oe1
3.15.1-2.oe1
sqlite-jdbc
openEuler:22.03-LTS
 before 3.15.1-2.oe2203sp2
3.15.1-2.oe2203sp2
sqlite-jdbc
openEuler:22.03-LTS-SP1
 before 3.15.1-2.oe2203sp1
3.15.1-2.oe2203sp1
sqlite-jdbc
openEuler:22.03-LTS-SP2
 before 3.15.1-2.oe2203sp2
3.15.1-2.oe2203sp2
xerial-sqlite-jdbc
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.36.0.3+dfsg1-13.36.0.3+dfsg1-23.36.0.3+dfsg1-3
 None known
xerial-sqlite-jdbc
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.42.0.0+dfsg-13.44.1.0+dfsg-13.44.1.0+dfsg-1build1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubshoucheng3/xerial__sqlite-jdbc_CVE-2023-32697_3-41-2-12025-08-17

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-32697 is a high vulnerability (CVSS 8.8) in Sqlite Jdbc Project Jdbc, published May 23, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. Fixed in org.xerial:sqlite-jdbc 3.41.2.2.

References

Show 4 moreShow less
This page doesn't list everything

Left out here: 8 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open